openapi: 3.2.0 info: contact: {} description: "Rulestacks defines access control (App-ID, URL Filtering) and threat prevention behavior of Cloud NGFW resources. \n\nA Cloud NGFW resource uses your rulestack definitions to protect the traffic by a two-step process. First, it enforces your rules on the to allow or deny your traffic. Second, it performs content inspection on the allowed traffic based on what you specify on the Security Profiles. \n\nA rulestack includes a set of security rules, associated objects, and profiles. \n\n### Permission Policies\n\n| Action | Local Firewall Administrator | Local Rulestack Administrator | Global Rulestack Administrator |\n| ------------------------------ | :---------------------------: | :---------------------------: | :----------------------------: |\n| Create a Rulestack | ☐ | **☑** | **☑** | \n| Delete a Rulestack | ☐ | **☑** | **☑** | \n| Describe a Rulestack | **☑** | **☑** | **☑** | \n| List Rulestacks | **☑** | **☑** | **☑** |\n| Update a Rulestack | ☐ | **☑** | **☑** |\n| List Security Rule Lists | **☑** | **☑** | **☑** |\n" title: Manage Rulestacks API version: 1.0.0 servers: - url: https://api.us-east-1.aws.cloudngfw.paloaltonetworks.com tags: - name: ManageRulestacks paths: /v1/config/rulestacks: get: description: 'Retrieve the metadata of rulestacks. Query rulestacks by tags using the format `/v1/config/rulestacks?tags=` to list rulestacks where the tag name starts with the specified string. DynamoDB supports this command and should be implemented as a library. ' operationId: get-v1-config-rulestacks parameters: [] requestBody: content: application/json: schema: $ref: '#/components/schemas/ListRuleStacksRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListRuleStacksResponse' description: OK summary: List rulestack metadata tags: - ManageRulestacks post: description: 'Create a global or local rulestack. Global role permissions apply only to global rulestacks, while local role permissions apply only to local rulestacks. ' operationId: post-v1-config-rulestacks parameters: [] requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateRuleStackRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/CreateRuleStackResponse' description: OK summary: Create rulestack resource tags: - ManageRulestacks /v1/config/rulestacks/{rulestackname}: delete: description: 'Delete a specific rulestack. ' operationId: delete-v1-config-rulestacks-rulestackname parameters: - description: 'The name of the rulestack. ' in: path name: rulestackname required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/DeleteRuleStackRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/DeleteRuleStackResponse' description: OK summary: Delete rulestack resource tags: - ManageRulestacks get: description: 'Retrieve the configuration data for a specific rulestack. ' operationId: get-v1-config-rulestacks-rulestackname parameters: - description: 'The name of the rulestack. ' in: path name: rulestackname required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/DescribeRuleStackRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/DescribeRuleStackResponse' description: OK summary: Retrieve rulestack resource tags: - ManageRulestacks put: description: 'Modify the rulestack configuration. Note that you cannot update the rulestack scope. ' operationId: put-v1-config-rulestacks-rulestackname parameters: - description: 'The name of the rulestack. ' in: path name: rulestackname required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateRuleStackRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/UpdateRuleStackResponse' description: OK summary: Update rulestack configuration tags: - ManageRulestacks /v1/config/rulestacks/{rulestackname}/commit: get: description: 'Retrieve the commit status of the specified rulestack. ' operationId: get-v1-config-rulestacks-rulestackname-commit parameters: - description: '' in: path name: rulestackname required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/DescribeCommitRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/DescribeCommitResponse' description: OK summary: Retrieve commit status tags: - ManageRulestacks post: description: 'Commit the specified rulestack. ' operationId: post-v1-config-rulestacks-rulestackname-commit parameters: - description: '' in: path name: rulestackname required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CommitRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/CommitResponse' description: OK summary: Commit rulestack changes tags: - ManageRulestacks /v1/config/rulestacks/{rulestackname}/revert: post: description: 'Revert all uncommitted changes for the specified rulestack. ' operationId: post-v1-config-rulestacks-rulestackname-revert parameters: - description: '' in: path name: rulestackname required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/RevertRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RevertResponse' description: OK summary: Revert rulestack changes tags: - ManageRulestacks /v1/config/rulestacks/{rulestackname}/validate: post: description: 'Validate the selected rulestack after commit. ' operationId: post-v1-config-rulestacks-rulestackname-validate parameters: - description: '' in: path name: rulestackname required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/ValidateRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ValidateResponse' description: OK summary: Validate rulestack changes tags: - ManageRulestacks components: schemas: UpdateRuleStackResponse: additionalProperties: false properties: Response: $ref: '#/components/schemas/UpdateRuleStackResponse.ResponseData' ResponseStatus: $ref: '#/components/schemas/UpdateRuleStackResponse.Result' title: UpdateRuleStackResponse type: object DeleteRuleStackResponse.Result: additionalProperties: false properties: ErrorCode: default: 0 title: Errorcode type: integer Reason: title: Reason type: string title: Result type: object UpdateRuleStackRequest.RuleStack: additionalProperties: false properties: AccountId: maxLength: 12 pattern: ^$|^[0-9]+$ title: Accountid type: string Description: maxLength: 512 title: Description type: string Profiles: $ref: '#/components/schemas/UpdateRuleStackRequest.RuleStackProfiles' Scope: enum: - Global - Local title: Scope type: string UpdateToken: title: Updatetoken type: string title: RuleStack type: object RevertRequest: additionalProperties: false properties: {} title: RevertRequest type: object CreateRuleStackRequest.RuleStackCreateType: additionalProperties: false properties: AccountId: maxLength: 12 pattern: ^$|^[0-9]+$ title: Accountid type: string Description: maxLength: 512 title: Description type: string Profiles: $ref: '#/components/schemas/CreateRuleStackRequest.RuleStackProfiles' Scope: enum: - Global - Local title: Scope type: string title: RuleStackCreateType type: object DescribeRuleStackRequest: additionalProperties: false properties: Candidate: default: true title: Candidate type: boolean MaxResults: exclusiveMaximum: 101 exclusiveMinimum: 0 title: Maxresults type: integer Running: default: false title: Running type: boolean title: DescribeRuleStackRequest type: object RevertResponse: additionalProperties: false properties: ResponseStatus: $ref: '#/components/schemas/RevertResponse.Result' RuleStackName: title: Rulestackname type: string title: RevertResponse type: object DescribeRuleStackResponse.TagEntry: additionalProperties: false properties: Key: maxLength: 128 minLength: 1 pattern: ^.*$ title: Key type: string Value: maxLength: 256 minLength: 1 pattern: ^.*$ title: Value type: string required: - Key - Value title: TagEntry type: object DescribeCommitResponse.ResponseData: additionalProperties: false properties: CommitMessages: items: type: string title: Commitmessages type: array CommitStatus: title: Commitstatus type: string RuleStackName: title: Rulestackname type: string ValidateMessages: items: type: string title: Validatemessages type: array ValidateStatus: title: Validatestatus type: string title: ResponseData type: object UpdateRuleStackResponse.ResponseData: additionalProperties: false properties: RuleStackEntry: $ref: '#/components/schemas/UpdateRuleStackResponse.RuleStack' RuleStackName: title: Rulestackname type: string title: ResponseData type: object ListRuleStacksResponse.RuleStackOperation: additionalProperties: false properties: Operation: enum: - add - delete - update title: Operation type: string RuleStackName: title: Rulestackname type: string required: - RuleStackName title: RuleStackOperation type: object ValidateResponse: additionalProperties: false properties: ResponseStatus: $ref: '#/components/schemas/ValidateResponse.Result' RuleStackName: title: Rulestackname type: string title: ValidateResponse type: object DescribeRuleStackResponse: additionalProperties: false properties: Response: $ref: '#/components/schemas/DescribeRuleStackResponse.ResponseData' ResponseStatus: $ref: '#/components/schemas/DescribeRuleStackResponse.Result' title: DescribeRuleStackResponse type: object DescribeRuleStackResponse.ResponseData: additionalProperties: false properties: RuleStackCandidate: $ref: '#/components/schemas/DescribeRuleStackResponse.RuleStack' RuleStackName: title: Rulestackname type: string RuleStackRunning: $ref: '#/components/schemas/DescribeRuleStackResponse.RuleStack' RuleStackState: title: Rulestackstate type: string Tags: items: $ref: '#/components/schemas/DescribeRuleStackResponse.TagEntry' title: Tags type: array title: ResponseData type: object ListRuleStacksResponse: additionalProperties: false properties: Response: $ref: '#/components/schemas/ListRuleStacksResponse.ResponseData' ResponseStatus: $ref: '#/components/schemas/ListRuleStacksResponse.Result' title: ListRuleStacksResponse type: object ValidateResponse.Result: additionalProperties: false properties: ErrorCode: default: 0 title: Errorcode type: integer Reason: title: Reason type: string title: Result type: object RevertResponse.Result: additionalProperties: false properties: ErrorCode: default: 0 title: Errorcode type: integer Reason: title: Reason type: string title: Result type: object UpdateRuleStackResponse.RuleStack: additionalProperties: false properties: AccountId: maxLength: 12 pattern: ^$|^[0-9]+$ title: Accountid type: string Description: maxLength: 512 title: Description type: string Profiles: $ref: '#/components/schemas/UpdateRuleStackResponse.RuleStackProfiles' Scope: enum: - Global - Local title: Scope type: string UpdateToken: title: Updatetoken type: string title: RuleStack type: object DescribeRuleStackResponse.Result: additionalProperties: false properties: ErrorCode: default: 0 title: Errorcode type: integer Reason: title: Reason type: string title: Result type: object CreateRuleStackResponse.ResponseData: additionalProperties: false properties: RuleStackEntry: $ref: '#/components/schemas/CreateRuleStackResponse.RuleStack' RuleStackName: title: Rulestackname type: string title: ResponseData type: object DeleteRuleStackResponse.RuleStackCreateType: additionalProperties: false properties: AccountId: maxLength: 12 pattern: ^$|^[0-9]+$ title: Accountid type: string Description: maxLength: 512 title: Description type: string Profiles: $ref: '#/components/schemas/DeleteRuleStackResponse.RuleStackProfiles' Scope: enum: - Global - Local title: Scope type: string title: RuleStackCreateType type: object DescribeCommitResponse: additionalProperties: false properties: Response: $ref: '#/components/schemas/DescribeCommitResponse.ResponseData' ResponseStatus: $ref: '#/components/schemas/DescribeCommitResponse.Result' title: DescribeCommitResponse type: object DeleteRuleStackResponse.RuleStackProfiles: additionalProperties: false properties: AntiSpywareProfile: default: BestPractice enum: - custom - BestPractice title: Antispywareprofile type: string AntiVirusProfile: default: BestPractice enum: - custom - BestPractice title: Antivirusprofile type: string FileBlockingProfile: default: BestPractice enum: - custom - BestPractice title: Fileblockingprofile type: string OutboundTrustCertificate: title: Outboundtrustcertificate type: string OutboundUnTrustCertificate: title: Outbounduntrustcertificate type: string URLFilteringProfile: default: None enum: - custom - BestPractice - None title: Urlfilteringprofile type: string VulnerabilityProfile: default: BestPractice enum: - custom - BestPractice title: Vulnerabilityprofile type: string title: RuleStackProfiles type: object DescribeRuleStackResponse.RuleStack: additionalProperties: false properties: AccountId: maxLength: 12 pattern: ^$|^[0-9]+$ title: Accountid type: string Description: maxLength: 512 title: Description type: string Profiles: $ref: '#/components/schemas/DescribeRuleStackResponse.RuleStackProfiles' Scope: enum: - Global - Local title: Scope type: string UpdateToken: title: Updatetoken type: string title: RuleStack type: object CommitResponse: additionalProperties: false properties: ResponseStatus: $ref: '#/components/schemas/CommitResponse.Result' RuleStackName: title: Rulestackname type: string title: CommitResponse type: object ListRuleStacksResponse.Result: additionalProperties: false properties: ErrorCode: default: 0 title: Errorcode type: integer Reason: title: Reason type: string title: Result type: object CommitResponse.Result: additionalProperties: false properties: ErrorCode: default: 0 title: Errorcode type: integer Reason: title: Reason type: string title: Result type: object ListRuleStacksRequest: additionalProperties: false properties: Candidate: default: true title: Candidate type: boolean MaxResults: default: 1024 maximum: 1024 minimum: 1 title: Maxresults type: integer NextToken: title: Nexttoken type: string Running: default: false title: Running type: boolean Scope: default: All enum: - Global - Local - All title: Scope type: string TagKey: title: Tagkey type: string TagValue: title: Tagvalue type: string Uncommitted: default: false title: Uncommitted type: boolean title: ListRuleStacksRequest type: object ListRuleStacksResponse.ResponseData: additionalProperties: false properties: NextToken: title: Nexttoken type: string RuleStackCandidate: items: type: string title: Rulestackcandidate type: array RuleStackRunning: items: type: string title: Rulestackrunning type: array RuleStackUncommitted: items: $ref: '#/components/schemas/ListRuleStacksResponse.RuleStackOperation' title: Rulestackuncommitted type: array title: ResponseData type: object DescribeCommitRequest: additionalProperties: false properties: {} title: DescribeCommitRequest type: object CreateRuleStackResponse.RuleStack: additionalProperties: false properties: AccountId: maxLength: 12 pattern: ^$|^[0-9]+$ title: Accountid type: string Description: maxLength: 512 title: Description type: string Profiles: $ref: '#/components/schemas/CreateRuleStackResponse.RuleStackProfiles' Scope: enum: - Global - Local title: Scope type: string UpdateToken: title: Updatetoken type: string title: RuleStack type: object UpdateRuleStackResponse.Result: additionalProperties: false properties: ErrorCode: default: 0 title: Errorcode type: integer Reason: title: Reason type: string title: Result type: object DescribeRuleStackResponse.RuleStackProfiles: additionalProperties: false properties: AntiSpywareProfile: default: BestPractice enum: - custom - BestPractice title: Antispywareprofile type: string AntiVirusProfile: default: BestPractice enum: - custom - BestPractice title: Antivirusprofile type: string FileBlockingProfile: default: BestPractice enum: - custom - BestPractice title: Fileblockingprofile type: string OutboundTrustCertificate: title: Outboundtrustcertificate type: string OutboundUnTrustCertificate: title: Outbounduntrustcertificate type: string URLFilteringProfile: default: None enum: - custom - BestPractice - None title: Urlfilteringprofile type: string VulnerabilityProfile: default: BestPractice enum: - custom - BestPractice title: Vulnerabilityprofile type: string title: RuleStackProfiles type: object CreateRuleStackRequest: additionalProperties: false properties: RuleStackEntry: $ref: '#/components/schemas/CreateRuleStackRequest.RuleStackCreateType' RuleStackName: maxLength: 128 minLength: 1 pattern: ^[a-zA-Z0-9-]+$ title: Rulestackname type: string required: - RuleStackName title: CreateRuleStackRequest type: object CreateRuleStackResponse.RuleStackProfiles: additionalProperties: false properties: AntiSpywareProfile: default: BestPractice enum: - custom - BestPractice title: Antispywareprofile type: string AntiVirusProfile: default: BestPractice enum: - custom - BestPractice title: Antivirusprofile type: string FileBlockingProfile: default: BestPractice enum: - custom - BestPractice title: Fileblockingprofile type: string OutboundTrustCertificate: title: Outboundtrustcertificate type: string OutboundUnTrustCertificate: title: Outbounduntrustcertificate type: string URLFilteringProfile: default: None enum: - custom - BestPractice - None title: Urlfilteringprofile type: string VulnerabilityProfile: default: BestPractice enum: - custom - BestPractice title: Vulnerabilityprofile type: string title: RuleStackProfiles type: object UpdateRuleStackRequest.RuleStackProfiles: additionalProperties: false properties: AntiSpywareProfile: default: BestPractice enum: - custom - BestPractice title: Antispywareprofile type: string AntiVirusProfile: default: BestPractice enum: - custom - BestPractice title: Antivirusprofile type: string FileBlockingProfile: default: BestPractice enum: - custom - BestPractice title: Fileblockingprofile type: string OutboundTrustCertificate: title: Outboundtrustcertificate type: string OutboundUnTrustCertificate: title: Outbounduntrustcertificate type: string URLFilteringProfile: default: None enum: - custom - BestPractice - None title: Urlfilteringprofile type: string VulnerabilityProfile: default: BestPractice enum: - custom - BestPractice title: Vulnerabilityprofile type: string title: RuleStackProfiles type: object UpdateRuleStackResponse.RuleStackProfiles: additionalProperties: false properties: AntiSpywareProfile: default: BestPractice enum: - custom - BestPractice title: Antispywareprofile type: string AntiVirusProfile: default: BestPractice enum: - custom - BestPractice title: Antivirusprofile type: string FileBlockingProfile: default: BestPractice enum: - custom - BestPractice title: Fileblockingprofile type: string OutboundTrustCertificate: title: Outboundtrustcertificate type: string OutboundUnTrustCertificate: title: Outbounduntrustcertificate type: string URLFilteringProfile: default: None enum: - custom - BestPractice - None title: Urlfilteringprofile type: string VulnerabilityProfile: default: BestPractice enum: - custom - BestPractice title: Vulnerabilityprofile type: string title: RuleStackProfiles type: object CommitRequest: additionalProperties: false properties: {} title: CommitRequest type: object ValidateRequest: additionalProperties: false properties: {} title: ValidateRequest type: object DeleteRuleStackRequest: additionalProperties: false properties: {} title: DeleteRuleStackRequest type: object DescribeCommitResponse.Result: additionalProperties: false properties: ErrorCode: default: 0 title: Errorcode type: integer Reason: title: Reason type: string title: Result type: object CreateRuleStackRequest.RuleStackProfiles: additionalProperties: false properties: AntiSpywareProfile: default: BestPractice enum: - custom - BestPractice title: Antispywareprofile type: string AntiVirusProfile: default: BestPractice enum: - custom - BestPractice title: Antivirusprofile type: string FileBlockingProfile: default: BestPractice enum: - custom - BestPractice title: Fileblockingprofile type: string OutboundTrustCertificate: title: Outboundtrustcertificate type: string OutboundUnTrustCertificate: title: Outbounduntrustcertificate type: string URLFilteringProfile: default: None enum: - custom - BestPractice - None title: Urlfilteringprofile type: string VulnerabilityProfile: default: BestPractice enum: - custom - BestPractice title: Vulnerabilityprofile type: string title: RuleStackProfiles type: object DeleteRuleStackResponse.ResponseData: additionalProperties: false properties: RuleStackEntry: $ref: '#/components/schemas/DeleteRuleStackResponse.RuleStackCreateType' RuleStackName: title: Rulestackname type: string title: ResponseData type: object CreateRuleStackResponse: additionalProperties: false properties: Response: $ref: '#/components/schemas/CreateRuleStackResponse.ResponseData' ResponseStatus: $ref: '#/components/schemas/CreateRuleStackResponse.Result' title: CreateRuleStackResponse type: object DeleteRuleStackResponse: additionalProperties: false properties: Response: $ref: '#/components/schemas/DeleteRuleStackResponse.ResponseData' ResponseStatus: $ref: '#/components/schemas/DeleteRuleStackResponse.Result' title: DeleteRuleStackResponse type: object UpdateRuleStackRequest: additionalProperties: false properties: RuleStackEntry: $ref: '#/components/schemas/UpdateRuleStackRequest.RuleStack' title: UpdateRuleStackRequest type: object CreateRuleStackResponse.Result: additionalProperties: false properties: ErrorCode: default: 0 title: Errorcode type: integer Reason: title: Reason type: string title: Result type: object